Subscribe to the Law & Taxes Vietnam Newsletter on LinkedIn or via email!
Vietnam’s Draft Law on Data Security: Risk-based data classification, cross-border transfer controls and what enterprises should prepare now
The Ministry of Public Security has prepared a draft Law on Data Security that would change how enterprises classify, protect and transfer data. The draft is proposed for submission to the National Assembly in October 2026, which debated it in October and November 2026, and is proposed to take effect on 1 December 2027.
Key points:
- Data classification: Enterprises will be required to identify and classify the data they manage into categories, including Ordinary Data (Level 1), Internal Data (Level 2), Important Data (Level 3) and Core Data (Level 4).
- Cross-border transfers: Stricter requirements will apply to transfers of Important Data and Core Data outside Vietnam. This may affect multinational groups that rely on overseas servers, cloud infrastructure, shared regional databases or cross-border data processing arrangements.
- Penalties: Serious violations involving the protection of Important Data or Core Data may be subject to fines of up to 5% of the violator’s total revenue in the preceding financial year.
To prepare for the new requirements on data sharing and cross-border transfers, enterprises should begin identifying and classifying the data they manage, review their data storage and processing practices, and strengthen security measures and incident response capabilities.
Contributed by RÖDL Vietnam
Beneficial ownership under scrutiny: Year-end inspections of UBO declarations (Official Letter 3164/DNTN-GS) and what enterprises should check now
Beneficial ownership declarations are coming under scrutiny as year-end inspections approach. On 7 October 2026, the Department of Private Enterprise and Collective Economy Development under the Ministry of Finance issued Official Letter No. 3164/DNTN-GS on the declaration of enterprises’ beneficial owners.
Key points:
- Inspections of ultimate beneficial owner (UBO) declarations are scheduled for the last four months of 2026.
- Enterprises established before 1 July 2025 may be subject to fines of up to VND 100 million if they fail to supplement beneficial owner information (if any) when carrying out enterprise registration or change notification procedures.
Ahead of the inspections, enterprises should ensure that their UBO information is properly identified and declared. For companies established before 1 July 2025, this also means checking whether their beneficial owner information has been supplemented and including it in their next enterprise registration or change notification filing.
Contributed by RÖDL Vietnam
